Similar presentations

2
Scope This presentation is not about : –Juniper vs Cisco –A line per line conversion analysis It is about –Giving you an overview how hard/easy integrating Juniper in a Cisco network is.. –Providing you pointers should you want to look into it –Giving you a taste of the interesting feature of JunOS

3
Source of Information www.cymru.com –Secure Juniper BGP template Complete tested template Well documented Very good to learn from an example A little bit outdated No IGP at all Focused on security not features –Remotely triggered black hole example

4
Source of Information www.juniper.net –Cisco Configuration Converter Good to get a base configuration and for IGP Horrible (but correct) ACL and BGP route-map conversion Access not open (you may have to ask your reseller to get your configuration converted) –Documentation Cover clearly every section of the configuration Have lots of configuration snipsets Does not take you for a genius or a student of college Is good enough to allow you to write configs from it

6
The Routers Separation of the routing engine and forwarding plane BSD system on the background –Use unix commands (if you want) ls, ps, top, tcpdump, compile your own Every protocol has a daemon –Lots of HD space for logging Usual risk associated with having an HD Optional flash drive

7
Configuration Are loooooong … –Easily 2,000 lines for a EBGP routers But are very logical structure –Divided in section –From more generic to more specific –With the concept or inheritance Friendly –Everything can be commented –Everything can be deactivated Easy to manipulate –Merge/Replace/Overide from file/copy & paste/etc. –Export part of it/Save it all

8
Configuration Atomic changes –No time constrain to change the configuration –Automatic rollback if changes are not confirmed Automatic backup –possibility to rollback to any previous configuration version –Compare the current configuration with any stored backup –Export to ftp on change Changes are syntax checked –Can be a pain as it will not let you test a invalid configuration

10
Policies The JunOS route-map Used to –Originate routes –Filter route to learn / announce Are –a succession of term (if then blocks) Every keyword (term, from, then) if optional –terms can Accept a route Reject the route Let the next policy decide –Policies be build from other policies

13
Originate a route Filter can normally be chained allowing to reuse the power of other filters and thus making the configuration easier to maintain and more readable. However, originated routes need to be accepted in the filter where they are injected

14
Originate a route routing-options { aggregate { route 82.219.0.0/16 community 30740:65400; } policy-options { community originate members 30740:65400; policy-statement originate { term tag { from { protocol aggregate; community originate; } then { community delete originate; accept; } (static route can as well be used instead of aggregate)

17
Using BGP to setup firewall rules BGP and JunOS SCU can be use to build firewall rules from BGP tagged routes The same thing may be better done using Juniper flows implementation using the latest JunOS release. if interested see : http://www.atm.tut.fi/list-archive/juniper- nsp-2005/msg02043.html http://www.atm.tut.fi/list-archive/juniper- nsp-2005/msg02043.html

18
Complain No easy way to see flow information –Like show ip cache flow with cisco –Need to capture the packet and pass them to the control plane which can then get overloaded and become unresponsive –Same issue with netflow export, a DDOS may not take the forwarding plane off but may overload the netflow daemon, causing IGP/BGP update drop. –Juniper sell some hardware accelaration cards to offload those tasks from the CPU Learning curve and all which goes with it.

19
Conclusion What problem did the introduction of Juniper caused ? –Full BGP table leak to one peer due to mis- configuration … –5 minutes when the planned update to allow data flow collection obliged us to use out-of- band access to the router to rollback our changes All in one it went pretty well I would do it again …

20
Thank you for faking interest all the way through ( or not ) Questions ? ( If times allow )